diff --git a/codex-rs/login/src/auth/auth_tests.rs b/codex-rs/login/src/auth/auth_tests.rs
index ac95d22be3..27c9cc422c 100644
--- a/codex-rs/login/src/auth/auth_tests.rs
+++ b/codex-rs/login/src/auth/auth_tests.rs
@@ -1757,8 +1757,10 @@ async fn forced_server_auth_rejection_clears_stale_persistent_external_auth() {
         codex_home.path().to_path_buf(),
         /*enable_codex_api_key_env*/ false,
         AuthCredentialsStoreMode::File,
+        /*forced_chatgpt_workspace_id*/ None,
         /*chatgpt_base_url*/ None,
         AuthKeyringBackendKind::default(),
+        /*auth_route_config*/ None,
     )
     .await;
     let rejected_auth_fingerprint =
diff --git a/codex-rs/login/src/auth/manager.rs b/codex-rs/login/src/auth/manager.rs
index 3b388b9b99..5a52a6d530 100644
--- a/codex-rs/login/src/auth/manager.rs
+++ b/codex-rs/login/src/auth/manager.rs
@@ -179,8 +179,13 @@ fn fingerprint_auth_dot_json(
         ApiAuthMode::AgentIdentity => {
             let record = auth_dot_json
                 .agent_identity
-                .as_deref()
-                .and_then(|jwt| AgentIdentityAuthRecord::from_agent_identity_jwt(jwt).ok())?;
+                .as_ref()
+                .and_then(|agent_identity| match agent_identity {
+                    AgentIdentityStorage::Jwt(jwt) => {
+                        AgentIdentityAuthRecord::from_agent_identity_jwt(jwt).ok()
+                    }
+                    AgentIdentityStorage::Record(record) => Some(record.clone()),
+                })?;
             Some(fingerprint_agent_identity_record(
                 kind,
                 serde_json::to_vec(&record).ok()?.as_slice(),